hiveiq-src/hiveops-guide
4
0
Fork 0
Code Issues 10 Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

[session 1] docs(guide): technical.aria ingest noise filter (aria#12) (#52)
CD - Develop (guide → bcos.dev) / build-and-deploy (push) Has started running
Details

Browse Source
This commit was merged in pull request #52.
This commit is contained in:
hiveiq
2026-07-22 11:53:42 -04:00
parent 33283b749b
commit 4fccd30122
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main/resources/content/technical/aria/overview.md
+2 -1
View File
@@ -41,7 +41,7 @@ Base paths under `/api/aria`. Most read/admin endpoints require `hasRole('BCOS_A
| Method | Path | Purpose |
|--------|------|---------|
| POST | `/api/aria/ingest/events` | Agent/internal event ingestion (X-Service-Secret header, permitAll) |
| POST | `/api/aria/ingest/events` | Agent/internal event ingestion (X-Service-Secret header, permitAll). Events classified as INFO with no IOC/no attack phase are **dropped** before persistence — see Gotchas (aria#12) |
| POST | `/api/aria/posture/report` | Device posture report submission (permitAll) |
| GET | `/api/aria/posture` | List device postures |
| GET | `/api/aria/posture/{deviceId}` | Single device posture |
@@ -64,6 +64,7 @@ Base paths under `/api/aria`. Most read/admin endpoints require `hasRole('BCOS_A
- **Auth model:** stateless JWT (`JwtAuthenticationFilter`) + `@EnableMethodSecurity`. Almost every admin/read endpoint uses `hasRole('BCOS_ADMIN')` — note it is **BCOS_ADMIN only**, not the usual `hasAnyRole('MSP_ADMIN','BCOS_ADMIN')` seen elsewhere.
- **Public endpoints:** `/api/aria/ingest/**` and `/api/aria/posture/report` are `permitAll()` in `SecurityConfig`. Ingestion is instead gated by the `X-Service-Secret` header compared to `aria.internal.service-secret` (`ARIA_SERVICE_SECRET`) — **but only if that secret is non-blank**; if unset, the endpoint accepts any request.
- `GET /api/aria/ioc/active` has no `@PreAuthorize`, so any authenticated caller can read active IOCs (unlike the BCOS_ADMIN-gated `/ioc`).
- **Ingest noise filter (aria#12):** `ThreatEventIngestionService` drops events that classify as INFO severity with **no matched IOC and no attack phase** *before* persisting — they never publish to Kafka (only HIGH/CRITICAL do) and cannot form a precursor sequence (`SequenceDetectionService` ignores null-phase events and requires `PHYSICAL_ACCESS`). This kills the Windows **4663** object-access flood: agents send the **bare** signal key `4663`, which misses the classifier's `EVENT_4663` case and lands in the INFO default branch (68M rows / 14 GB in 37 days before the fix). Toggle `aria.ingest.drop-unclassified-info` (`ARIA_DROP_UNCLASSIFIED_INFO`, default `true`); a running dropped-count is logged. Set `false` to persist everything again.
- **Sequence detection window:** `aria.sequence.window.minutes` (`ARIA_SEQUENCE_WINDOW_MINUTES`, default 15).
- **Feed refresh:** scheduled via cron `aria.feed.refresh.cron` (default `0 0 3 * * *`), toggle `ARIA_FEED_ENABLED` (default true). Optional API keys for OTX / MalwareBazaar / ThreatFox.
- **Auto-response is off by default:** `aria.autoresponse.shutdown.enabled=false`. Auto-response fleet tasks would call hiveops-incident (`INCIDENT_SERVICE_URL`, default `http://hiveiq-incident:8080`).